Check Point Harmony Endpoint Reviews

We primarily use the solution to prevent and detect the abnormalities and viruses on endpoints. 

It's also to monitor endpoints and the use of endpoints when it comes to identifying items like USB sticks, etc. because it's not really in our company policy to allow the use of a USB at work stations.

The most valuable feature is the integration with Check Point's firewalls. You can have one port, and follow the logs from both Endpoint and firewall security.

The solution could improve VPN functionality and the VPN user-interface.

The solution is very stable. We are quite happy with the solution, and we have had very few issues with it.

Scalability is very good. 

Technical support is fairly good. I'd rate it three out five. It's fairly good, but not optimal. 

Check Point could offer better personal support. They have a ticket system, but once you create a ticket, it can take up to seven to days before you get any feedback at all. Depending on the situation or the problem that we have, that's far too long.

We previously had a Cisco solution.

The initial setup was complex. From an IT department perspective, we don't have that many IT technicians, so, for us, it was complex. If we had put an IT engineer on Check Point, it might have been easier. 

Implementation took about two days. The strategy was to do the implementation outside of office hours, so it was actually done over a weekend.

We are outsourcing the maintenance, which is about 4 hours of work a month.

We had a consultant assist us in the implementation.

We pay roughly 80,000 Swedish krona per year. When it comes to the firewall, it's roughly 150,000 Swedish krona yearly. There's also maintenance, of course, which is roughly 10,000 krona per month.

We evaluated a few solutions, including Cylance. We evaluated the existing solutions and compared them to Check Point.

My advice to others considering implementing the solution is, depending of course on if the company is looking for a new kind of firewall solution, is "Don't do it yourself."

I would rate the solution eight out of ten.

We use the solution for endpoint security.

The solution provides endpoint security, ransomware protection, endpoint detection, and response. Also, cloud-based management is a good feature with an excellent catch rate.

If you're using an endpoint that does not have sufficient resources, it would be very tough to use. Most of them will shut down, but it works well with the detection so far. The solution can reduce the impact of the endpoints.

The performance impact should be improved. Also, the tool should have the ability to search for files. It could make on-premise deployment easier. They might have blocked ports and the control makes it more difficult. They can make implementation much easier even with what they have.

I have been using Check Point Harmony Endpoint as a reseller for three to four years.

The solution is stable.

It is a very scalable solution. It is well-suited for medium business. I rate the solution’s scalability a nine out of ten.

Technical support is responsive.

The tool is easy to set up but the on premise management is difficult. The deployment takes three hours to complete.

I rate the initial setup a seven out of ten, where one is difficult, and ten is easy.

The solution is reasonable, but there are cheaper solutions out there.

Smaller customers go with the cloud, whereas the bigger ones opt for on-premise management.

I recommend the solution.

Overall, I rate the solution an eight out of ten.

Our company uses Harmony Endpoint for encryption and encapsulation. Our clients use it for data encryption.

The most valuable feature is Harmony Endpoint's encapsulation system which captures the whole system and protects it against other functions. It is really good for the Check Point Harmony specialists.

In terms of improvement, the ticketing system could be better.

I have been using Check Point Harmony Endpoint for about three months. 

In terms of stability, I would rate it an eight out of ten.

I would rate the scalability of the solution a solid eight out of ten. It could be slightly improved. Approximately 1000 people use Harmony Endpoint at our company. The maintenance is done once a week by a team of three engineers.

In the Harmony series, the products are linked to each other. It is a little tricky when you try to open a case and give it to an engineer because, in our custom environment, we have to access it from their devices. For example, in Harmony Mobile, their Android or iPhone devices have to be used. All of that takes time and it would be good if Check Point could find a better solution to this and create a feature to help us collect logs for the cases. I would rate the support a six out of ten.

Neutral

I'm currently working with Cisco Secure Endpoint and Palo Alto Cortex XDR. 

We use both the cloud and on-premise solutions. The initial setup is simple and creating a profile with the agents is easy. We only create agents and direct them to versions of the agents while we integrate them with the process. It only takes about five minutes to deploy one mission.

We have seen good results with the solution. If it is used with Linux or Mac, it provides better performance.

Check Point Harmony Endpoint is a subscription-based solution and the pricing is quite reasonable when compared to other solutions on the market. I would give it a nine out of ten in terms of affordability.

My advice to people who are considering using Check Point Harmony Endpoint is to be careful of which version you choose while deploying the solution. You should get the recommended versions for the agents. Otherwise, there will be a lot of problems and soft ticketing. Overall, I would rate Harmony Endpoint a seven out of ten.

As a financial company, we use the solution to provide security to our CDE environment and compliance with all PCI requirements. This tool enables us to provide security to the endpoints and also, to comply with local and foreign regulations regarding platform security.

We use this solution to protect all our endpoints, including personal computers and mobile phones. 

We have deployed the solution in Windows, Linux servers, workstations, and mobile phones. 

We also use the web filter capabilities both on mobile phones and on corporate computers.  

We now have so many capabilities we did not have before, as follows:

• We are able to manage all our endpoints from a single cloud console
• We don't need adicional on-premise servers to run this solution
• The time that the endpoint refresh and identify new policies is very short. It takes seconds and this is a great value for us to fight emerging threats
• We are now able to protect web browsing in all web browsers and also we don't need additional policies to block browsers in private browsing
• The integratión with our SIEM solution was very smooth and the solution provides valuable information for security analysis
  

The most valuable aspects include:

• Web Filtering. This feature is easy to manage, and it applies new policies in seconds. 
• Real-time Click Protection. It protects the user from phishing attacks in real time. 
• Compatibility with Windows, Linux, Android, and Mac. We don't need additional solution to protect all our endpoint. 
• Cloud Management. This feature allows us to reduce our operating burden and also improve our TCO.

We now have the ability to block a compromised machine from the network.

We now have the ability to block in near real-time IOC.

It would also be great to include DLP capabilities for the endpoint so that we do not have to deploy additional agents on servers or PCs or use additional products. 

It would also be great to include FIM capabilities for the Endpoint so that we do not have to deploy additional agents on servers or PCs or use additional products.

It would be great if we could have additional DLP capabilities to identify personal information or any kind of information to comply with regulations that require information protection. 

I have been using the solution for about three months.

We haven't had any problems or downtime since we acquired the solution. It is stable.

The solution is scalable. It is quite simple to add new endpoints to the solution or add additional features, all with zero downtime. 

Customer support and channel support are also always willing to help. 

Positive

We have been using McAfee Endpoint protection for about ten years. We were missing so many features and needed additional tools and effort to protect our endpoint. 

It took a few minutes to deploy the whole solution.

It was through a vendor. They were experts on the product.

The costs depend on the company size. In my case, I was able to have all the features, including email protection, remote access, mobile protection, and endpoint protection, for a great price. 

I evaluated Trend Micro and McAfee.

We continue to offer our support solutions to other companies as requested. I focus on cyber security, specifically specializing in detecting malware in text and searching for remote access or reverse channels on computers.

This software incorporates security AI features and effectively manages bandwidth with its DRS capabilities. However, there's still room for improvement and the addition of more features. Nevertheless, in the broader market landscape, it's considered one of the leading products. While there might be some competition from others like Cisco, it remains a strong choice. The feature lies in mapping and providing top-notch malware protection.

Perhaps the software could be made more resource-efficient. While many improvements come to mind, I don't have them readily available. Essentially, I aim to enhance the software's efficiency so that it places fewer demands on computer resources.

I have been working with Check Point Harmony Endpoint for the past two years.

It is a stable solution and I would rate it seven out of ten.

It isn’t very scalable since I wasn't able to bypass the security a couple of times. I would rate it a six out of ten. 

I would rate it a six out of ten because it could have been easier. It might be somewhat challenging due to the numerous policies in place. For instance, it's more straightforward for me when users can easily set up policies because they come built-in. However, with Check Point, you do have the option to create custom policies. I'm not entirely certain if it's a strict either/or situation, as there might be some flexibility. Nonetheless, having a predefined "zero one" option can make it easier for users, as they don't necessarily have to customize policies themselves.

The deployment takes long enough.

Currently, this software stands out as one of the top choices in the field. It's undoubtedly a strong contender for enhancing computer security, and while there are various other products available, this one ranks among the best.

I recommend the solution, but I would rate it a six out of ten, mainly because the software requires considerable resources and can strain less powerful computers. It tends to impact system efficiency, especially on computers with weaker hardware, causing frequent restarts and putting a significant load on the CPU and memory.

We wanted to consolidate a several-point solution to one endpoint. With so many new cyber threats and having a growing environment, what we had in place had too many gaps or grey areas between solutions and vendors. 

Also, with a rapid transition to hybrid working, we needed to reconsider our end point protection. Having used Check Point NGFW for five years, it seemed like a good fit. Also, the experience and long term position of Check Point in the security market gave us good confidence. This mature position in the market also helped with finding several resellers and experience.

There is one pane of glass to all end points, events, and incidents which is providing our team with a clear picture of the environment. We have already experienced several items that previously just got lost in the greyness of a multi-solution environment.

The rollout and management of devices were very simple. It allowed for a rollout of 200+ devices - all remote - in just a couple of weeks. Having cloud-based management also really helped get started, as, within the day, we had a POC running and just started to grow from there.

Cloud management and reporting are great. The management interface is very simple and easy to navigate. Just getting a logon to start is very helpful. The Check Point support at this stage was great. While it was very simple and intuitive, having someone talk over the defaults provided recommendations that helped us jump forward very easily.

Again, the cloud management service has a several inbuilt default reports which are easy to customize and provide more visibility than we have had previously with several solutions. 

The web filter service could be improved. It would be great to have a self-service user request for sites. An administrator would still need to approve, however. 

The block screen could have a nicer screen or allow it to be customized.

The list of exceptions for URLs could be improved with a separate screen for a large list of exceptions. Having the same exception list for mobile and endpoints would be great. 

We are hoping to transition to the SOC based service. Think this is still new; we're looking forward to get more information and test.

We just transitioned to Check Point Harmony, and have been running it now for six weeks.

Stability seems very strong, however, it's early days.

Scalability seems very strong, however, it is early days.

We don't know yet.

Positive

The move to hybrids has been working well during Covid.

The initial setup was not complex. 

We did both - we implemented through a vendor and in-house.

The product offers a great lower cost than previous solutions.

I'd advise users to talk to your Check Point partners or find a good one.

We spent a long time reviewing the marketplace and comparison sites however, we did not test anything.

I am very positive in terms of the solution and Check Point in general.

There have been improvements in the way our organization functions, as, from an administrative perspective, and being available and taking upgrades out of our court if our users need it, it's going to be out there hanging off of AWS's internet or environment. There is no downtime.  

Theirs (AWS) is probably more highly available than ours. Other than that, it's supposed to be the same product that we were using. It's a Check Point Management Station to a Check Point Management Station in the cloud. Basically, it's not that much of a difference. We have upgraded all the clients since, and we're on one of the later versions of the VPN clients that are supported by the new Management Station. The old Management Station wasn't supporting the newer clients anymore.

The new clients seem to be faster and more stable. Those are improvements that everyone in the company can appreciate. They can VPN and connect faster. They're more resilient. I've noticed that they try to reconnect. If our internet goes out for 20 minutes and you VPN'd in, it will actually reconnect on its own at the same token, which is amazing. Before, if only the slightest instability of the internet connection disconnected you from VPN, you were then required to put in your RSA token and password, and username. That is annoying for people as a lot of people's WiFi's aren't that great and/or they're in some airport or something and might momentarily disconnect.

We love that we don't have to upgrade it anymore. They take care of that.

The upgrade process was nice with the new Management Station compared to the old one. I like how they have the clients already available. I didn't have to download them and upload them as I did with the old Management Station.

We're happy with the solution overall as it takes away the administrative overhead of operating it and patching it and being able to also sign in through the web browser anywhere as opposed to just having to VPN back to our work and connect to the Management Station in order to use it. We can just use the Check Point portal and just use any browser anywhere. That gives us more options, which we like. 

I've noticed they're constantly updating the interface and making it easier to use, which I appreciate. When we first started using it, it was really laggy and it was really slow and it was hard to sort some of the computers and users, however, they make updates almost every time that I log in. It gets better and better every day. It has gotten better and it's not as slow as it was.

There seem to be constant improvements happening, which you can't say for everything. We don't have to upgrade to get the benefits of the improvements, either. That takes a lot off of our plate and allows us to focus on other things. We're taking the good with the bad and the bad seem to be one-offs and we're looking forward to the future.

Therefore, the most valuable feature is its ability to take the management and the administration of the product off of our plate and onto their plate. We don't have to worry about upgrading it, creating downtime, working off-hours, doing all the research and stress of seeing if it's compatible, if there are problems, letting them test it. That's nice. Previously, we would upgrade our products or patch them maybe two to four times a year, depending on if there's a security vulnerability. Each time we do something like that, it was about three to four hours of downtime. Now, that process doesn't exist. 

Before, with on-premise, we had two Management Stations. One was primary, one was secondary and there were two different data centers in case one data center was down. The other one would come up and be the Management Station for all of the clients. Now, in this case, we only have one. It's in their cloud. Their cloud is in AWS. It's a great thing. It's resilient by design and it provides redundancy in a single source of administration for us. We like that too

It would be ideal if they had a migration tool of some sort.

There were some caveats that we encountered on the new Management Station. For example, they had some features that were not supported by older clients. There are the clients that are running on the laptops, and there are the Management Stations, and then we had one on-premise, which was older in terms of the clients that we were running. Then we had the new Management Station in the Cloud that Check Point is administering as it is a SaaS, which is a benefit.

The newer Management Station has features that it enforced on the clients that the clients weren't able to support. For example, Windows Service or Windows Subsystem Linux. Everyone in my company that uses Windows Subsystem Linux, which is about 15 or 20 people, that need it on a daily basis, were running the older clients of course, as they were migrated over the new Management Station and they weren't allowed to use that. It was being blocked automatically due to the fact that that was the new policy being enforced that was literally a tick box in the new Management Station that I didn't set. Even if I enabled WSL, it didn't matter. The older clients couldn't take advantage of the new newer Management Station telling them to use it. That was annoying trying to troubleshoot that and figure it out. tNo one at Check Point really knew that was the problem. It took a while to resolve. We finally figured out upgrading may solve the problem. When we did that, we upgraded those users, however, that created a little bit of an issue in the company, as we upgraded those users. We like to test them with a small group and make sure they're stable and make sure nothing weird happens. We were forced to upgrade them without testing first. 

One thing they still haven't improved on from the old Management Station to the new Management Station, which should totally be an improvement, is when you create a Site List for the VPN clients and you deploy it from the Management Station, you are not able to get that Site List. You have to play around with something called the Track File, which is a miserable process. You have to download the client, decrypt the Track File, edit it, then upload it again to the Management Station and download the client a second time and then test it and make sure the Track File's in the right order of sites as well, due to the fact that it's kind of random how it decides to order the Site List. The Site List is what the clients use to connect to the VPN Gateway, and if you have more than one gateway, for example, for disaster recovery, which we do, then they'll need that list.

It's something they've never improved on, which I was hoping by going to the cloud and having this whole thing recreated. Since it's more advanced I thought they'd have that ability to edit the Site List with the initial download. You should be able to just add the sites and then that's it. That kind of sucks that you can't. 

Other than that, the only other thing I could complain about was that they did this process where they did some type of certificate update on the backend of all of their staff solutions. That created downtime for our VPN clients and they didn't notify us of the certificate update. We're using the product in their cloud as opposed to their product on-premise, which seemed to be more stable in that regard. They didn't communicate that out. However, when we spoke to support after about a week, they told us there was this thing they did the past week, and that's the reason why we had that problem. Everyone that had that product had that problem. That really wasn't ideal.

I've been using the solution for about a year. Maybe a little bit more. 

We've been a Check Point shop for approximately 15 years. We're very well versed in Check Point.

Seeing that it's in the Cloud, I think it's very scalable and I am impressed with that aspect of it.

For this solution, in particular, we are using 100% of the Cloud VPN Management Station and all users are phoning home up into the cloud. We're going to stick with it unless they have some severe outages or certificate updates without telling us like they did last time. Right now, there's no reason for us to change and I'm very pleased with the product.

To set it up, we relied heavily on technical support as it was new. That said, it's really the same ball of wax, so we're good now. It was just the initial setup we needed help with as it was new to us. We hadn't done much. We had to learn how to connect our software clients to the cloud. We had to use special cloud keys that were proprietary to Check Point. It's like learning a new suite from Check Point. 

We literally got on this as it was cutting edge. We're like one of their first customers using their SaaS. We were using their VPN and Smart-1 Cloud before most people. When we were setting it up, we're setting it up with their actual product engineers or whatever. It was interesting.

They changed it a lot since we started setting it up. 

I'd call them to their support and they didn't even know about anything due to the fact that the support wasn't even trained on the cloud yet. They weren't even trained on their Smart-1. They would just say "we don't know about that yet and/or we can't help you." It was kind of funny. I told our sales team that and they got pissed.

They called them and they're like, no one should ever tell the customer that you don't know about this yet and it became a big deal in Check Point. 

That said, I'd rate their service as pretty high. I respect those in the endpoint or firewall department as they largely understand what's going on. At the same time, they do need to get people more people trained up. They don't seem to have trouble keeping people around for a few years so that they learn.

After signing up with Check Point, the migration of users took about a month and a half. 

We had to build out the Management Station in Check Point too and that took from probably January to almost July as we had to build it from scratch. They didn't have a migration tool for our current policy, as it enforces firewall policy on the endpoints locally on the local firewall and that wasn't ideal. We had to build that whole Management Station from scratch.

I had to go back and forth between the on-premise Management Station and the Cloud Management Station and literally look at every single feature, every single function, every single rule. I had to recreate every single object. I had to recreate every single everything. That took a very long time.

It was very manual. It's literally two screens and comparing items. That took a couple of months while doing other things, of course. However, that was my priority for about a month and a half. I worked on that a lot. I wish they had a migration tool, like a migrate export for the policy and the features. Once that was created, however, everything pretty much worked. That said, there were a couple of caveats. 

We're customers of Check Point.

I've been working on setting it up and migrating users from the on-premise platform since January of this year. This is their Cloud Endpoint, VPN Management Station versus their on-premise VPN Management Station for Endpoint. We had to migrate the users from the on-premise version using a special tool that you have to ask them to make, which is kind of weird, however, their product is so new that that's the way that they do it. I had to deploy that tool to all the users in our company and that switched them over to their Cloud Management Station.

I'd rate the solution at an eight out of ten. There's room for improvement, however, I respect it and it works well.

The main option for which this solution is used is to have all the peripheral equipment protected - avoiding risks due to malware and viruses. The solution can be managed by device, with filtering and analysis of the information of all collaborators available there. 

It's used to analyze emails from key users and for content filtering rules. It does not allow dangerous downloads, which protects the work of the organization outside the main network. It gives tools to the collaborators to make the work outside the installations (home office) easy.

With COVID affecting the world, a solution was needed that could be able to provide security at workstations outside of the organization itself. With the sandblast tool, coverage is made on the equipment that we provide (laptops) and employees can carry out their activities from home. The tool has provided us with security to ensure that the computers are protected while also providing information analysis. It offers easy control and implementation of content filtering rules. Thus, you have control of all the organization's teams outside and within the operational network.

The endpoint agents, which can be installed in one go, are great. The communication with the console is very dynamic and remote, without the need to return to the computer locally. 

From the administration console, we can generate content filtering rules and labels, as well as run an analysis of emails and downloads that the collaborator does to fulfill their functions. Informing the administrator of threats by mail gives us the facility to detect real-time vulnerabilities in order to continue fulfilling the objective of safeguarding the information of the organization.

There needs to be compatibility with the most recent versions of the various operating systems. They need to be up-to-date with the signatures of new viruses and the latest ramsonware. With the encompassing of all its solutions in one platform, there should be artificial intelligence for specific analysis to thus be able to anticipate and detect unique risks to the organization. 

To be able to count on the administration console on any device and online cloud would be ideal. We would like there to be no need to install clients as executables.

I've been using the solution for one year.

We like the idea of ​​continuing to implement more solutions offered by Harmony.

Technical support is good. They comply when we need support or have product questions.

No, Sandblast was chosen as the first option.

The solution meets our business needs. 

We did look at Fortinet solutions.